Novell Access Manager

Transcription

1 SSL VPN User Guide AUTHORIZED DOCUMENTATION Novell Access Manager 3.1 SP1 March 17, Novell Access Manager 3.1 SSL VPN User Guide

2 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the Novell International Trade Services Web page ( for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals. Copyright Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. Novell, Inc. 404 Wyman Street, Suite 500 Waltham, MA U.S.A. Online Documentation: To access the latest online documentation for this and other Novell products, see the Novell Documentation Web page (

3 Novell Trademarks For Novell trademarks, see the Novell Trademark and Service Mark list ( trademarks/tmlist.html). Third-Party Materials All third-party trademarks are the property of their respective owners.

4 4 Novell Access Manager 3.1 SSL VPN User Guide

5 Contents About This Guide 7 1 Overview of SSL VPN Access Modes Kiosk Mode Enterprise Mode Client Machine Requirements Linux Requirements Mac Requirements Windows Requirements Accessing SSL VPN in Kiosk Mode Accessing the SSL VPN User Portal Switching from Kiosk Mode to Enterprise Mode Accessing SSL VPN in Enterprise Mode Prerequisites Accessing SSL VPN When You Are an Admin or root User Accessing SSL VPN as a Non-Admin User Switching from Enterprise Mode to Kiosk Mode Enabling Sudo Command for Standard Users in Mac OS Accessing Published Citrix Applications through SSL VPN Accessing Published Citrix Applications in Kiosk Mode Accessing Published Citrix Applications in Enterprise Mode Understanding the SSL VPN User Interface SSL VPN User Interface Sandbox Feature Using SSL VPN Using the SSL VPN Home Page Using the Policies Page Viewing SSL VPN Logs Enabling Applications for SSL Enabling Linux Applications for SSL Enabling Macintosh Applications for SSL Enabling Terminals for SSL Logging Out of the Active SSL VPN Session Connecting after the Session Timeout Period Downloading the Applet on Internet Explorer Contents 5

6 A Troubleshooting SSL VPN 35 A.1 SSL VPN Fails to Connect on a Windows 7 Machine A.2 SSL VPN fails to Load If Firefox 3.0 is used on Vista 64-bit A.3 Unable to Connect to SSL VPN Due to the OpenVPN Error A.4 SSL VPN Applet Fails to Download on SLED bit Machine A.5 Unable to Connect to SSL VPN A.6 SSL VPN Connection Fails with an OpenVPN Connection Error A.7 Browser Cache Is Not Cleared When Multiple Tabs are Used in Vista A.8 Failed to Connect to SSL VPN A.9 Mozilla Firefox Browser Displays an X Mark A.10 Applications Are Not Enabled from the Terminal after Running the su Command A.11 SSL VPN Session Disconnects after Approximately 10 Hours A.12 Error: Failed to Download the SSLVPN Files from Gateway A.13 Unable to Connect After Previous Connection Ended Abruptly A.14 SSL VPN Client Displays the Nonsecure Items Dialog Box A.15 Clear Cache Option Retains Some Image Files in the Temporary Internet Folder A.16 SSL VPN Fails to Fetch Help Pages When There Is an Error A.17 Browser Goes to a Non-Responsive Mode If Clear Browser Private Data is Repeatedly Clicked A.18 SSL VPN Issues with Latest Versions of JRE A.19 Unable to Access Protected HTTP Applications By Using a Safari Browser A.20 Linux Browser Issues in Kiosk Mode A.21 Issues with the Intlclock Toolbar Application A.22 Socks Client Logs Are Displayed under Service Logs B Error Messages 43 6 Novell Access Manager 3.1 SSL VPN User Guide

7 About This Guide This user guide is intended to help you understand and use the SSL VPN user portal. It contains the following information: Chapter 1, Overview of SSL VPN, on page 9 Chapter 2, Accessing SSL VPN in Kiosk Mode, on page 13 Chapter 3, Accessing SSL VPN in Enterprise Mode, on page 17 Chapter 4, Accessing Published Citrix Applications through SSL VPN, on page 23 Chapter 5, Understanding the SSL VPN User Interface, on page 25 Chapter 6, Using SSL VPN, on page 29 Appendix A, Troubleshooting SSL VPN, on page 35 Appendix B, Error Messages, on page 43 Audience This guide is intended for Novell Access Manager SSL VPN end users. Feedback We want to hear your comments and suggestions about this manual and the other documentation included with this product. Please use the User Comments feature at the bottom of each page of the online documentation, or go to and enter your comments there. Documentation Updates For the most recent version of the SSL VPN User Guide, visit the Novell Access Manager Documentation Web site ( Additional Documentation Novell Access Manager 3.1 SP1 SSL VPN Server Guide Novell Access Manager 3.1 SP1 Installation Guide Novell Access Manager 3.1 SP1 Setup Guide Novell Access Manager 3.1 SP1 Administration Console Guide Novell Access Manager 3.1 SP1 Identity Server Guide Novell Access Manager 3.1 SP1 Access Gateway Guide Documentation Conventions In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and items in a cross-reference path. A trademark symbol (, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. About This Guide 7

8 When a single pathname can be written with a backslash for some platforms or a forward slash for other platforms, the pathname is presented with a backslash. Users of platforms that require a forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software. 8 Novell Access Manager 3.1 SSL VPN User Guide

9 1Overview of SSL VPN The Novell Access Manager SSL VPN allows you to use a Web browser to access corporate resources securely from a remote site. It uses a Secure Socket Layer (SSL) with a virtual private connection (VPN). It is a clientless solution, and it eliminates the need to install or configure a VPN client on your desktop or laptop. This gives you the flexibility to access the corporate resources from a laptop, a home computer, or a Web browsing kiosk. When you access the SSL VPN server through a Web browser, a Java* applet or an ActiveX* control is installed on your machine after the successful connection. This encrypts the traffic passing through the tunnel and sends it to the SSL VPN server. This section describes the following features of SSL VPN: Section 1.1, Access Modes, on page 9 Section 1.2, Client Machine Requirements, on page Access Modes The Novell SSL VPN uses both clientless and thin-client access methods. The clientless method is called the Kiosk mode SSL VPN and the thin-client method is called the Enterprise mode SSL VPN. This section has the following information: Section 1.1.1, Kiosk Mode, on page 9 Section 1.1.2, Enterprise Mode, on page Kiosk Mode Kiosk mode is the usual choice for computers not controlled by the organization, such as home computers and computers in Web-browsing kiosks. When you connect to SSL VPN in Kiosk mode, only a limited set of applications are enabled for SSL. Applications that were opened before the SSL VPN connection was established are not enabled for SSL. You must manually enable the applications that were opened before the SSL VPN connection. For more information, see Section 6.4, Enabling Applications for SSL, on page 31. You are connected to SSL VPN in Kiosk mode if: You do not have administrator rights or root privileges to the workstation, and you do not know the credentials of the administrator or root user of the machine. You have the administrator rights or root privileges to the workstation, but you are required by the system administrator to connect in Kiosk mode only. For more information on using the Kiosk mode, see Chapter 2, Accessing SSL VPN in Kiosk Mode, on page Overview of SSL VPN 9

10 1.1.2 Enterprise Mode The Enterprise mode is the usual choice for computers that are controlled by the organization, such as notebooks provided by the organization for employees.when you connect to SSL VPN in Enterprise mode, all applications are enabled for SSL, regardless of whether they were opened before or after connecting to the SSL VPN. This includes your desktop applications and toolbar applications. You are connected to SSL VPN in Enterprise mode if: You are the administrator or root user of a workstation, as long as the system administrator has not required you to connect in Kiosk mode only. You are not the administrator or root user of a workstation, but you know the credentials of the administrator or root user. If someone with administrator access has preinstalled the SSL VPN thin client components on your machine, you can connect to SSL VPN in Enterprise mode. For more information on preinstalling the thin client components, see Preinstalling the SSL VPN Client Components in the Novell Access Manager 3.1 SP1 SSL VPN Server Guide. For more information on using Enterprise mode, see Chapter 3, Accessing SSL VPN in Enterprise Mode, on page Client Machine Requirements This section explains the operating software and browser requirements for the client machine, in order to access the SSL VPN user portal. Section 1.2.1, Linux Requirements, on page 10 Section 1.2.2, Mac Requirements, on page 11 Section 1.2.3, Windows Requirements, on page Linux Requirements When you access the SSL VPN user portal in the Linux environment, a Java applet is downloaded to the client machine. The following table lists the supported versions of operating software and browsers for the Linux environment: Table 1-1 Supported Linux Configurations Component Requirement Operating Systems SUSE Linux Enterprise Desktop (SLED) 10.0 and SLED 11. OpenSSL Shells or higher. If your OpenSSL version is higher than 0.9.7, you must install an OpenSSL compatible library. bash xterm Browser Mozilla* Firefox* 2.x or 3.0 Java and JavaScript* enabled 10 Novell Access Manager 3.1 SSL VPN User Guide

11 Component Sun* JRE* Requirement 1.5.0_11 or higher NOTE: If you are using SLED bit client, make sure that you have the latest JRE installed on your machine Mac Requirements When you access the SSL VPN user portal in the Mac* environment, a Java applet is downloaded to the client machine. The following table lists the supported versions of operating software and browsers in the Mac environment: Table 1-2 Supported Macintosh Configurations Component Operating System Requirement Mac PPC 10.4 Tiger* OpenSSL Mac Intel 10.5 Leopard* Shell Browser bash Mac Safari* Build 412 or higher Firefox 2.x or 3.0 Java and JavaScript enabled Sun* JRE* 1.5.0_11 or higher NOTE: GroupWise 7.0 and 8.0 does not work when SSL VPN Kiosk mode is running on Macintosh* Tiger* OS Windows Requirements When you access the SSL VPN user portal in the Windows* environment, an ActiveX control is downloaded to the client machine. If you want to download the Java applet on your machine instead of the ActiveX control, the administrator needs to perform some server-side configurations. For more information, refer to Configuring SSL VPN to Download the Java Applet on Internet Explorer in the Novell Access Manager 3.1 SP1 SSL VPN Server Guide. The following table lists the supported versions of operating software and browsers in the Windows environment: Overview of SSL VPN 11

12 Table 1-3 Supported Windows Configurations Component Requirement Operating System Windows 2000 SP4 Windows XP SP2 Windows Vista* Windows 7 NOTE: If you are using Windows 7, you must follow a certain procedure to enable a successful SSL VPN connection. For more information, see Section A.1, SSL VPN Fails to Connect on a Windows 7 Machine, on page 35. Browser Internet Explorer* 6.0 SP 2, 7.0 and 8.0 Mozilla Firefox 2.x or 3.0 NOTE: Do not use Windows Explorer to access the SSL VPN client. Sun* JRE* or higher NOTE: If you are using Firefox 3.6, you must have Java SE 6 update 10 or higher. 12 Novell Access Manager 3.1 SSL VPN User Guide

13 2Accessing SSL VPN in Kiosk Mode Kiosk mode is the usual choice for computers not controlled by the organization, such as home computers and computers in Web-browsing kiosks. In the Kiosk mode of SSL VPN, only those applications that are opened after connecting to the SSL VPN server are enabled for SSL. You must manually add the applications that were opened before connecting to SSL VPN in order to enable them for SSL. For more information on manually adding the applications, see Section 6.4, Enabling Applications for SSL, on page 31. This section has the following information on accessing SSL VPN in Kiosk mode: Section 2.1, Accessing the SSL VPN User Portal, on page 13 Section 2.2, Switching from Kiosk Mode to Enterprise Mode, on page 15 For information on connecting to the SSL VPN user portal in Enterprise mode, see Chapter 3, Accessing SSL VPN in Enterprise Mode, on page Accessing the SSL VPN User Portal 1 Log in to the SSL VPN server by using the following URL: Replace <dns_name> with the DNS name of your SSL VPN server. 2 2 On the Access Manager page, specify the username and password, then click OK. 3 Click Yes in the warning message to accept and download the signed ActiveX control or Java applet required for the SSL VPN client. The SSL VPN mode selection dialog box is displayed. Accessing SSL VPN in Kiosk Mode 13

14 4 Do one of the following: Select Kiosk Mode (Current) to connect to SSL VPN in Kiosk mode for the current session. When you select this option, you are prompted to enter the username and password for the administrator user the next time you log in. Click Kiosk Mode (Always) to always connect to SSL VPN in Kiosk mode. When you select this option, you are connected to SSL VPN in Kiosk mode in the subsequent logins without being prompted to select the mode. If you want to connect to SSL VPN in Enterprise mode in one of the subsequent connections, you can do so. For more information, see Section 2.2, Switching from Kiosk Mode to Enterprise Mode, on page Click OK. If you click Cancel you are connected to SSL VPN in Kiosk mode for the current session. 6 (Conditional) If you are using Internet Explorer to connect to SSL VPN and the following page is displayed: Click the link displayed in option 2 to proceed with the SSL VPN connection. This page is displayed because, if you are a non-admin user of the machine, you cannot download the ActiveX control, which is essential to establish the SSL VPN connection. It downloads the applet on your machine and establishes the connection. 7 If the SSL VPN connection is successful, the SSL VPN Home page is displayed. Make sure that you keep the browser open throughout the SSL VPN session. 8 Do one of the following, depending on whether you are a Linux, Macintosh, or Windows user: Linux: If you are a Linux user, open a new terminal to launch applications that need to be enabled for SSL. For more information, see Section 6.4.1, Enabling Linux Applications for SSL, on page 31. Macintosh: If you are a Macintosh user, open a new terminal to launch applications that need to be enabled for SSL. For more information, see Section 6.4.2, Enabling Macintosh Applications for SSL, on page Novell Access Manager 3.1 SSL VPN User Guide

15 Windows: If you are a Windows user, open applications that you want to access from your protected network. 9 If the SSL VPN connection fails, then an error message is displayed: Click Logout to close the session and retry. For more information on these error messages, see Appendix B, Error Messages, on page Switching from Kiosk Mode to Enterprise Mode If you selected Kiosk Mode (Always) in the dialog box of SSL VPN, you are connected to SSL VPN in Kiosk mode in subsequent connections. However, you can switch to Enterprise mode after you connect. 1 Connect in Kiosk mode. 2 Click Exit to log out of the current session. 3 Select the Enable Enterprise mode check box in the Exit SSL VPN page. 4 Log in again in Enterprise mode. For more information on connecting to SSL VPN in Enterprise mode, see Chapter 3, Accessing SSL VPN in Enterprise Mode, on page 17. Accessing SSL VPN in Kiosk Mode 15

16 16 Novell Access Manager 3.1 SSL VPN User Guide

17 3Accessing SSL VPN in Enterprise Mode The Enterprise mode is the usual choice for computers that are controlled by the organization, such as notebooks provided by the organization for employees. When you access the SSL VPN user portal in Enterprise mode, all applications are enabled for SSL, whether they were opened before or after the SSL VPN connection was made. This section contains the following information on using the SSL VPN user portal in Enterprise mode: Section 3.1, Prerequisites, on page 17 Section 3.2, Accessing SSL VPN When You Are an Admin or root User, on page 17 Section 3.3, Accessing SSL VPN as a Non-Admin User, on page 19 Section 3.4, Switching from Enterprise Mode to Kiosk Mode, on page 21 Section 3.5, Enabling Sudo Command for Standard Users in Mac OS, on page 21 For information on connecting to the SSL VPN user portal in Kiosk mode, see Chapter 2, Accessing SSL VPN in Kiosk Mode, on page Prerequisites To connect to SSL VPN in Enterprise mode: You should be an admin user in the Windows environment or root user in the Linux or Macintosh environment, or a user with the administrative or root user access. If you are a non-admin or a non-root user and do not have admin or root user access, you must pre-install the client components. For more information on pre-installing the client components, see Preinstalling the SSL VPN Client Components in the Novell Access Manager 3.1 SP1 SSL VPN Server Guide. You must have the recommended browser or operating software installed in your system. For more information, see Section 1.2, Client Machine Requirements, on page 10. If you are a standard user, make sure that the sudo command is enabled. For more information, see Section 3.5, Enabling Sudo Command for Standard Users in Mac OS, on page Accessing SSL VPN When You Are an Admin or root User If you are an admin or root user, the Enterprise mode of SSL VPN is enabled by default unless the SSL VPN administrator has configured you to connect in Kiosk mode only. 1 Log in to the SSL VPN server by using the following URL: Replace <dns_name> with the DNS name of your SSL VPN server. 3 Accessing SSL VPN in Enterprise Mode 17

18 2 On the Access Manager page, specify the username and password, then click OK. 3 Click Yes in the warning message to accept and download the signed applet components required for SSL VPN. 4 If the connection is successful, the SSL VPN Home page is displayed, allowing access to all the resources listed on the Policy tab. Make sure that you do not close this browser during the SSL VPN session. 5 If the SSL VPN connection fails, then an error message is displayed. 18 Novell Access Manager 3.1 SSL VPN User Guide

19 Click Logout to log out of the session. For more information on these error messages, see Appendix B, Error Messages, on page Accessing SSL VPN as a Non-Admin User If you are a non-admin or a non-root user, but you know the credentials of the administrator or root user, you can connect to SSL VPN in Enterprise mode as follows: 1 Log in to the SSL VPN server by using the following URL: Replace <dns_name> with the DNS name of your SSL VPN server. 2 On the Access Manager page, specify the username and password of the administrator or the root user of the machine, then click OK. 3 Click Yes to download the signed applet components required for SSL VPN. 4 Select Enterprise mode login in the dialog box prompting you to select a mode of SSL VPN. Accessing SSL VPN in Enterprise Mode 19

20 5 Specify the username and password of the root user, then click OK. You are connected to SSL VPN in Enterprise mode in subsequent connections. You are not prompted for the administrator or root username and password the next time you log in. NOTE: If you click OK in the dialog box to enable Enterprise mode of SSL VPN and you want to switch to the Kiosk mode on the same machine, see Section 3.4, Switching from Enterprise Mode to Kiosk Mode, on page (Conditional) If you are using the Internet Explorer browser and the ActiveX control is not installed, the following page is displayed with a yellow toolbar prompting you to download the ActiveX control: Click the toolbar to install the ActiveX control. 7 If the connection is successful, the SSL VPN Home page is displayed, allowing access to all the resources listed on the Policy page. Make sure that you do not close this browser during the SSL VPN session. 8 If the SSL VPN connection fails, then an error message is displayed. 20 Novell Access Manager 3.1 SSL VPN User Guide

21 For more information on these error messages, see Appendix B, Error Messages, on page Switching from Enterprise Mode to Kiosk Mode If you are a non-admin or non-root user and you enabled the Enterprise mode of SSL VPN, you are connected to SSL VPN in the Enterprise mode in subsequent logins. You can return to Kiosk mode on the same workstation during the next login. 1 Connect in Enterprise mode. 2 Click Exit to log out of the current session. 3 Select the Uninstall Enterprise mode check box on the Exit SSL VPN page. 4 Log in again in Kiosk mode. 5 For more information on connecting to SSL VPN in Kiosk mode, see Chapter 2, Accessing SSL VPN in Kiosk Mode, on page Enabling Sudo Command for Standard Users in Mac OS Novell SSL VPN uses the sudo command to gain root privileges for non-root users in Mac OS. The sudo command is not enabled by default for standard users in Mac OS. To manually enable the command, do the following: 1 Open /etc/sudoers 2 Add the following lines: Defaults targetpw ALL ALL=(ALL) ALL 3 Save and close the file. Accessing SSL VPN in Enterprise Mode 21

22 22 Novell Access Manager 3.1 SSL VPN User Guide

23 4Accessing Published Citrix Applications through SSL VPN You can access published Citrix* applications through SSL VPN. Section 4.1, Accessing Published Citrix Applications in Kiosk Mode, on page 23 Section 4.2, Accessing Published Citrix Applications in Enterprise Mode, on page 23 For more information, see Configuring SSL VPN for Citrix Clients in the Novell Access Manager 3.1 SP1 SSL VPN Server Guide. 4.1 Accessing Published Citrix Applications in Kiosk Mode 1 Connect to a Citrix server by using the following URL: name of Citrix Server>/Citrix/MetaFrame Replace <DNS name of Citrix Server> with the DNS name of your Citrix server. The Access Manager login page is displayed. 2 Specify your login credentials. 3 Click Allow to accept and download signed certificates and change the browser setting. 4 Click OK in the dialog box when you are prompted. The SSL VPN connection is automatically established. You can now access the published applications by clicking the corresponding icons on the Citrix Web page. 4.2 Accessing Published Citrix Applications in Enterprise Mode 1 Connect to a Citrix server using the following URL: name of Citrix Server>/Citrix/MetaFrame Replace <DNS name of Citrix Server> with the DNS name of your Citrix server. The Access Manager login page is displayed. 2 Specify your login credentials. You are authenticated to both the Citrix and SSL VPN servers. 3 Depending on your server-side configuration, you might need to accept and download signed certificates. When you are prompted, click Allow. The SSL VPN connection is automatically established. You can now access the published applications by clicking the corresponding icons on the Citrix Web page. 4 Accessing Published Citrix Applications through SSL VPN 23

24 24 Novell Access Manager 3.1 SSL VPN User Guide

25 5Understanding the SSL VPN User Interface When you connect to SSL VPN through the browser, the SSL VPN Home page is displayed after you authenticate to the server. Section 5.1, SSL VPN User Interface, on page 25 Section 5.2, Sandbox Feature, on page SSL VPN User Interface Figure 5-1 SSL VPN User Interface 5 This page displays the following: Home: Displays the customer or the product information. This page can be customized for different organizations. For more information on the home page, see Section 6.1, Using the SSL VPN Home Page, on page 29. Exit: Click the Exit icon to log out of the current session. For more information on the Exit page, see Section 6.5, Logging Out of the Active SSL VPN Session, on page 32. Policies: Displays the resources accessible by the user based on the traffic policies configured for your role. The traffic policies are configured by the administrator on the server. For more information on the Policies page, see Section 6.2, Using the Policies Page, on page 29. Log Entries: Displays ActiveX* or Java applet logs. For more information on the Log Entries page, see Section 6.3, Viewing SSL VPN Logs, on page 30. Applications: Specifies steps to add desktop applications to SSL VPN. This tab is available only in the Kiosk mode of Linux and Macintosh, because in these two platforms, applications that were opened before establishing the SSL VPN connection are not enabled for SSL. For more information on the Applications page, see Section 6.4, Enabling Applications for SSL, on page 31. Username: Specifies the name of the currently logged-in user in the top left corner of the page. Duration: Specifies the duration that the SSL VPN connection has been on. Understanding the SSL VPN User Interface 25

26 Sent: Displays bytes sent through the tunnel. Received: Displays bytes received through the tunnel. Idle: Displays the time left in minutes before disconnecting, if there was no data transfer happening in the tunnel. Status of Connection: Indicates the state of connection. The following table describes the different connection statuses: Status <Mode> Disconnected Connecting Disconnecting Error: Message Description Indicates that the Java applet or ActiveX has successfully established a connection to the SSL VPN server. It also displays the mode of SSL VPN. Indicates that the user has logged out of the SSL VPN server. This status is displayed when the user clicks the Exit button. Indicates that the connection is in progress. To avoid problems, the user must wait until a successful connection status is displayed before clicking any other button. Indicates that the disconnection is in progress. To avoid problems, the user must wait until a successful disconnection status is displayed before clicking any other button. Indicates that ActiveX or the Java applet has an error. Check ActiveX or the Java applet log for more information on the error. For more information on the error messages, see Appendix B, Error Messages, on page Sandbox Feature The SSL VPN client comes with the sandbox feature. When you connect to SSL VPN in either Kiosk mode or Enterprise mode, a folder named VPN-SANDBOX is created on your desktop. You can copy all the files, folders that you have downloaded from your corporate network, or that you have created into this folder. This folder is automatically deleted when the SSL VPN connection is terminated. This is a very useful feature if you are browsing from an internet Kiosk and you do not want any sensitive information to reach other persons. Figure 5-2 Sandbox Folder on Your Desktop The Browser Agent logs indicate that the Sandbox folder is created on your desktop. For more information on how to view SSL VPN logs, see Section 6.3, Viewing SSL VPN Logs, on page Novell Access Manager 3.1 SSL VPN User Guide

27 Figure 5-3 Log message on the Sandbox Folder You can manually copy any files that you download from your corporate network or any other location into this folder. This folder is automatically deleted along with its contents when you log out of the SSL VPN connection. This feature is not the same as the desktop cleanup feature of SSL VPN, where the browser history and the cookies are deleted when you log out of the SSL VPN connection. For more information on the desktop cleanup feature, see Section 6.5, Logging Out of the Active SSL VPN Session, on page 32. Understanding the SSL VPN User Interface 27

28 28 Novell Access Manager 3.1 SSL VPN User Guide

29 6Using SSL VPN When you connect successfully to SSL VPN, the SSL VPN Home page is displayed to you by default. You use this page as the central point for your SSL VPN activities. Make sure that you do not close the browser during the session. To access Web pages from the protected network, use another browser instance. This section has the following information: Section 6.1, Using the SSL VPN Home Page, on page 29 Section 6.2, Using the Policies Page, on page 29 Section 6.3, Viewing SSL VPN Logs, on page 30 Section 6.4, Enabling Applications for SSL, on page 31 Section 6.5, Logging Out of the Active SSL VPN Session, on page 32 Section 6.6, Connecting after the Session Timeout Period, on page 34 Section 6.7, Downloading the Applet on Internet Explorer, on page Using the SSL VPN Home Page Click the Home icon to display the Home page. How this page is displayed to you depends on how your organization has customized this page. The following figure displays the default Novell SSL VPN home page. Figure 6-1 SSL VPN Home Page Using the Policies Page To view the Policies page: 1 On the SSL VPN Home page, click the Policies icon. Using SSL VPN 29

30 2 Review the information on the page. This page displays the resources you can access based on the traffic policies configured by your system administrator for your role. The information is displayed as follows: Name: The name of the traffic policy applicable for your role. Destination: The IP address of the destination network. Port: The destination port. Protocol: TCP, UDP, or ICMP. Action: The action can be Encrypt or Deny. If the action is Encrypt, you are permitted to access the protected resources. If the action is Deny, you are denied access to the protected resources. 6.3 Viewing SSL VPN Logs The Log Entries page displays the log files. These log files are useful to you or your system administrator for troubleshooting any issues that come up during the connection. 1 On the SSL VPN Home page, click the Log Entries icon. The Log Entries page is displayed. 30 Novell Access Manager 3.1 SSL VPN User Guide

31 2 To view logs for a particular component or action, click one of the following links from View Log: Browser Agent Logs: Displays the ActiveX or applet logs. Install Logs: Displays the installation logs. Tunnel Logs: Displays the tunnel logs. Service Logs: Displays logs about the SSL VPN service. CIC Logs: Displays the Client Integrity Check logs. Cleanup Logs: Displays the cleanup logs. However, no desktop cleanup logs are displayed if you are using ActiveX. NOTE: Occasionally, the cleanup logs might display messages such as Error copying file or File not found exception. These messages indicate that there was an error in making a back up of some of the files. These messages do not affect the desktop cleanup or indicate that the desktop cleanup process is incomplete. 3 Click Save Logs, then select a location to save the log files. You can alternatively use one of the following shortcut keys to save logs, depending on your browser. NOTE: If you are using Mac OS, then manually specify a name for the folder to save logs. If you are using Firefox, press Alt+Shift+s. If you are using Safari, press Alt+Shift+Ctrl+s. If you are using Internet Explorer, press Alt+s. 6.4 Enabling Applications for SSL When you add an application to SSL VPN, it is described as SSLizing the application. If you are a Kiosk mode user in Linux or Macintosh, you must enable applications for SSL if they were opened before the SSL VPN connection was established. This section has the following information: Section 6.4.1, Enabling Linux Applications for SSL, on page 31 Section 6.4.2, Enabling Macintosh Applications for SSL, on page 32 Section 6.4.3, Enabling Terminals for SSL, on page Enabling Linux Applications for SSL 1 Start the SSL VPN services. 2 Create desktop shortcuts for application that you want to enable for SSL. 3 On the SSL VPN page, click the Application tab, then click SSLize Application. 4 Launch the application from the desktop shortcut. NOTE: Applications in the program menu are not enabled for SSL in Linux Using SSL VPN 31

32 6.4.2 Enabling Macintosh Applications for SSL 1 Create alias of the application you want to enable for SSL by selecting the application and pressing Command+L. 2 Drag and drop the newly created alias into the SSL VPN folder on desktop. 3 On the SSL VPN Home page, click the Application tab, then click SSLize Application. 4 Launch the application by using the alias in the SSL VPN folder on desktop Enabling Terminals for SSL To enable terminals that were opened either before or after the start of SSL VPN for SSL in Linux or Macintosh, do one of the following: Run bash on bash shell. Run tcsh on tcsh or csh shell. 6.5 Logging Out of the Active SSL VPN Session Use the following procedure to log out of the active SSL VPN session. Do not disconnect the session by closing the browser. If you close the browser, without exiting the session, the client components that were downloaded to establish the SSL VPN connection might not be deleted from your machine. NOTE: If you have logged into SSLVPN from multiple machines using the same credentials, you are logged out of all the machines when you log out from one of them. To log out of the active SSL VPN session: 1 On the SSL VPN Home page, click the Exit icon. The following Exit SSL VPN page is displayed when Internet Explorer is used: Following Exit SSL VPN page is displayed when Firefox is used: 32 Novell Access Manager 3.1 SSL VPN User Guide

33 2 Select one or more of the following options to log out: Leave Behind the Client Component: Select this check box to reduce the connection time when you log in again. If you select the check box, some of the SSL VPN components are left on the client and the connecting time is reduced because these components are not downloaded again. If you do not enable the Leave Behind the Client Component check box: All the client components downloaded for the connection are removed in Kiosk mode. All client components other than the service RPM or service MSI are removed in Enterprise Mode. This is because the service RPM or service MSI is mandatory for operation in this mode. Uninstall Enterprise Mode: This check box is displayed if you clicked OK in the SSL VPN dialog box, so you can always connect to SSL VPN in the Enterprise mode. Clear Browser Private Data: If you use Internet Explorer to establish the SSL VPN connection, this option appears as a check box. If you use Firefox to establish the SSL VPN connection, this option appears as a button. Select this option to clear the browser history and cache when logging out. When you select this option, all the data and information that were saved after the SSL VPN connection was made is cleared. In the Firefox browser, any previous browsing history or data that was present before the SSL VPN connection was made is not cleared. Clear Java Cache: Select this check box to clear the Java cache when logging out. This clears not just the files and applets used by SSL VPN, but all files and applets in the cache. NOTE: If you are using Firefox or the Force JRE option in Internet Explorer, the logout options selected during the previous login will not be displayed, if you used the same instance of the browser to connect to SSL VPN again. 3 (Conditional) If you are using Firefox and have clicked the Clear Browser Private Data button in the previous step, the following dialog box is displayed: Using SSL VPN 33

34 Click Allow to clear browser private data. If you do not want this dialog box to appear every time you logout, select Remember this decision before clicking Allow. 4 Select the Remember My Option check box to save the logout options that you chose. If you select this option, you are logged out of subsequent sessions without being prompted to select the logout options. 5 Click Logout. NOTE: In Firefox and Safari browsers, all the components downloaded on the system to establish the SSL VPN connection, cookies and cache are deleted from the system when all instances of the browser are closed after disconnecting. 6.6 Connecting after the Session Timeout Period If there is no data communication over the SSL VPN channel for more than the specified timeout period, the connection becomes inactive. You must log in again to establish the SSL VPN session. Do not use Refresh, Back, or Forward options in the browser. 6.7 Downloading the Applet on Internet Explorer The SSL VPN client components are carried forward to client desktop through Java applet or ActiveX, along with the policies and the required client components. Some Windows clients do not allow ActiveX controls to run in the Internet Explorer. In such scenarios, the user can force the Windows client to load a Java-based applet instead of the ActiveX controls. In order to force load the applet, enter the following URL to launch the SSL VPN user interface: 34 Novell Access Manager 3.1 SSL VPN User Guide

35 ATroubleshooting SSL VPN This section provides various troubleshooting scenarios that you might encounter while configuring SSL VPN. Section A.1, SSL VPN Fails to Connect on a Windows 7 Machine, on page 35 Section A.2, SSL VPN fails to Load If Firefox 3.0 is used on Vista 64-bit, on page 36 Section A.3, Unable to Connect to SSL VPN Due to the OpenVPN Error, on page 36 Section A.4, SSL VPN Applet Fails to Download on SLED bit Machine, on page 37 Section A.5, Unable to Connect to SSL VPN, on page 37 Section A.6, SSL VPN Connection Fails with an OpenVPN Connection Error, on page 38 Section A.7, Browser Cache Is Not Cleared When Multiple Tabs are Used in Vista, on page 38 Section A.8, Failed to Connect to SSL VPN, on page 38 Section A.9, Mozilla Firefox Browser Displays an X Mark, on page 38 Section A.10, Applications Are Not Enabled from the Terminal after Running the su Command, on page 39 Section A.11, SSL VPN Session Disconnects after Approximately 10 Hours, on page 39 Section A.12, Error: Failed to Download the SSLVPN Files from Gateway, on page 39 Section A.13, Unable to Connect After Previous Connection Ended Abruptly, on page 39 Section A.14, SSL VPN Client Displays the Nonsecure Items Dialog Box, on page 40 Section A.15, Clear Cache Option Retains Some Image Files in the Temporary Internet Folder, on page 40 Section A.16, SSL VPN Fails to Fetch Help Pages When There Is an Error, on page 40 Section A.17, Browser Goes to a Non-Responsive Mode If Clear Browser Private Data is Repeatedly Clicked, on page 40 Section A.18, SSL VPN Issues with Latest Versions of JRE 1.6, on page 41 Section A.19, Unable to Access Protected HTTP Applications By Using a Safari Browser, on page 41 Section A.20, Linux Browser Issues in Kiosk Mode, on page 41 Section A.21, Issues with the Intlclock Toolbar Application, on page 41 Section A.22, Socks Client Logs Are Displayed under Service Logs, on page 41 A.1 SSL VPN Fails to Connect on a Windows 7 Machine The SSL VPN client installation on a Windows 7 message fails after authentication. To enable SSL VPN connection on a Windows 7 machine, do the following: 1 Browse and open the <home>/<user> folder. 2 Log in to SSL VPN by using a supported browser. A Troubleshooting SSL VPN 35

36 3 Specify the username and password when prompted, then click OK. 4 When the status of Downloading the client is 100 %, the novl-sslvpn-serviceinstall.exe file is copied to <home>/<user> folder. 5 Copy this file to another location. 6 The SSL VPN connection that you are trying to establish fails. 7 Close the browser. 8 Double click novl-sslvpn-service-install.exe to install. 9 Log in to SSL VPN from another instance of the browser. The SSL VPN connection is established successfully. A.2 SSL VPN fails to Load If Firefox 3.0 is used on Vista 64-bit When a user tries to connect to SSL VPN by using Firefox 3.0 (32-bit) on Vista 64-bit, the SSL VPN applet fails to load. This is because, Sun JRE 1.6 Update 12 additionally bundles a newer Java plugin for Firefox because of which some applets fail to load. To work around this problem, disable the newer Java plug-in and roll back to the older plug-in as follows: 1 Open the Java Control Panel in one of the following ways: Browse to <Install_Folder>\Java\jre6\bin, then run Javacpl.exe. Go to Start > Control Panel > Java 2 Select Advanced > Java Plug-in and deselect the Enable the next generation Java plug-in option. 3 Select Advanced > Default Java For Browsers and make sure that Mozilla Family option is enabled. 4 Restart the browser. A.3 Unable to Connect to SSL VPN Due to the OpenVPN Error Occasionally, SSL VPN connection in Enterprise mode fails and the following OpenVPN error message is displayed in the log files: 36 Novell Access Manager 3.1 SSL VPN User Guide

37 Failed to Renew DHCP IP Address Lease on TAP-Win 32 Adapter: The system cannot find the file specified. To workaround this issue, do the following before attempting to connect to SSL VPN again: 1 Select Start > Control Panel > Network Connections. 2 Right-click the Local Area Connection with the device name TAP-Win 32 Adapter, then select Properties. 3 Click Configure, then select the Advanced tab. 4 Select Media Status and set the value to Always Connected. 5 Click OK. A.4 SSL VPN Applet Fails to Download on SLED bit Machine If you are using SLED bit machine, the SSL VPN applet might fail to download after logging in and a blank page would be displayed to you. This is because, SSL VPN fails to load the page as the browser fails to find the appropriate JRE plug-in installed in the client machine. To work around the problem, do the following: 1 Specify the following command to check if JRE plug-in is installed: rpm -aq grep jre-plugin 2 If JRE plug-in is not installed, select YaST > Software Management. 3 Search and install the Sun JRE plug-in. 4 Reconnect to SSL VPN. A.5 Unable to Connect to SSL VPN If you are unable to connect to SSL VPN, check the SSL VPN logs to see if there is any reference to proxy configuration. If there is a reference, it implies that SSL VPN is unable to establish a connection with the server through forward proxy. To enable SSL VPN to connect through forward proxy, modify the proxy.conf file as follows: 1 Browse to the user home directory and open proxy.conf. If the file does not already exist, create a text file in the user home directory and save it as proxy.conf. 2 Enter the proxy configuration information in the following format: proxyhost=<ip address>:<port> Replace <IP address> with the IP address of the forward proxy and <port> with the port number. 3 Save and close the file. NOTE: If you are using Firefox to connect to the SSL VPN server, restart the browser before reconnecting. Troubleshooting SSL VPN 37

38 A.6 SSL VPN Connection Fails with an OpenVPN Connection Error If your previous connection failed with an error, you might get this error when you try to reconnect. Select the Logout button in the Exit page to log out of the session and reconnect again. Check to see if the Log Entries > Tunnel logs displays the following message: No Buffer Space Available This indicates that there is not enough buffer space. You must free memory space by closing some of the applications that are running, or by restarting the machine, then reconnecting to SSL VPN. A.7 Browser Cache Is Not Cleared When Multiple Tabs are Used in Vista In Windows* Vista 32-bit and 64-bit machines, if you use multiple tabs in the same browser to access protected resources, the browser cache is not cleared from the registry entry, even if you have selected Clear Browser Cache in the Exit page. This issue occurs if Internet Explorer versions earlier than 7.0 are used with the Add Tab plug-in or if Internet Explorer 7.0 is used to connect to SSL VPN, and the protected resources are accessed in the other tabs of the same resource. To clear the cache, browse to the following location and manually delete the files: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs A.8 Failed to Connect to SSL VPN Sometimes the SSL VPN connection might fail with the error message Failed to Connect to SSL VPN. If this error occurs, you need to clear the Java cache and then try to connect to SSL VPN again. On a Linux machine, enter the following command in the command prompt: /usr/lib/jvm/jre/bin/controlpanel On a Windows machine, do the following: 1 Control Panel > Java. 2 Click Delete Files in the General tab. 3 Select the Downloaded Applets check box in the Delete Temporary Files dialog box. 4 Click OK. A.9 Mozilla Firefox Browser Displays an X Mark If you see an X on the top left corner of Mozilla Firefox while trying to access the SSL VPN end user portal, it indicates that the Java Runtime Environment* (JRE) is not installed on the client machine. Install Sun JRE 1.5.0_11 or above from 38 Novell Access Manager 3.1 SSL VPN User Guide

39 A.10 Applications Are Not Enabled from the Terminal after Running the su Command If you are a Linux or a Macintosh user, do the following to access the private network after running the su command in a terminal: If you are using the Bash shell, run the source sslize_bashrc file located in the home directory of the logged-in user. If you are using the tcsh or csh shell, run the source sslize_tcshrc file located in the home directory of the logged-in user. If you have changed directories after running the su command, you must give the complete path to the above files. A.11 SSL VPN Session Disconnects after Approximately 10 Hours If the SSL VPN client session disconnects after being in use for approximately 10 hours, check the version of JRE*. If the version of JRE is 1.4, download and install JRE 1.5 or later. A.12 Error: Failed to Download the SSLVPN Files from Gateway If you see the Failed to download the SSLVPN Files from Gateway error while trying to connect to SSL VPN through the Internet Explorer, add the forcejre=true command at the end of the URL as follows: For example, A.13 Unable to Connect After Previous Connection Ended Abruptly If you needed to close the SSL VPN connection in the previous session by closing the browser because the browser stopped responding, you might not be able log in to SSL VPN again. This is because some of the SSL VPN processes are running on your system. To work around the problem: 1 Close all the instances of the browser. 2 Delete the polresolver, stunnel, openvpn, java client-clear.jar and java_vm processes as follows: If you are a Linux user, kill the processes by using the following command: pkill <processname> If you are a Windows user, press Ctrl+Alt+Delete to invoke the Windows Task Manager, select the Processes tab, select the processes, and click End Process. Troubleshooting SSL VPN 39